cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
Size 29KB
Sample260925-xdqsrstglc
SHA256 cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04
MD5 9ec06c20cc9c39ef5e04011da0622e6b
SHA1 a375405845e66292eb511eee3e29beb8ace56450
SHA512 2f7bd960bf7d79c8feef3f111ec47417d1e6c83ec215718db9dde4aaff39cffd7c54d5c8cc63e903737c7fbaffb3cd6a20f35c2fe98c764948d0a1e6e3eb532f
SSDEEP 768:b0NbTbHCVklgq4UtHKBqOEdkL2FikxbJe+QP:bsz+klz4ksXP
TLSH
T192D22B47675444F2D2EB4674B6520F3B9FBE88743B91E4A7C7335BC29CA42D2A534207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3564	DiskMan32.exe
2412	nrkujq.exe
4120	qrlasx.exe
4996	qvhwmk.exe
2548	vmqhtr.exe
5228	duyqqi.exe
952	drweyb.exe
3528	ixbzcz.exe
1532	fnsljh.exe
3176	keboip.exe
4656	prhnma.exe
2032	sjhlnz.exe
5812	xayoto.exe
6124	uqhasw.exe
1096	zhydze.exe
2488	frspsl.exe
1580	klvfcx.exe
5856	pzawyb.exe
1912	mtumiv.exe
2704	rgaley.exe
1228	rgklov.exe
2816	brlema.exe
1568	brvfxx.exe
1168	bhuouo.exe
4772	gnanqr.exe
6252	jplybc.exe
6416	ruiuvp.exe
6572	ttaaen.exe
6732	lqgomg.exe
6900	oikupe.exe
7064	ylmnnj.exe
6328	ecdymq.exe
6684	jtlcky.exe
4804	gkcfro.exe
3836	ingzdq.exe
700	nampzc.exe
4732	suogao.exe
2904	yhteer.exe
4176	vychdh.exe
2436	asfynt.exe
6824	courlv.exe
2732	fcjkqp.exe
5392	nwtyql.exe
4668	kbzxuw.exe
400	kjjxft.exe
7316	rvtlfp.exe
7500	rzszmh.exe
7636	ukefhx.exe
7868	xvfgfc.exe
8020	zyjsrn.exe
8180	eozdyu.exe
7408	kquhrt.exe
7620	mqunza.exe
7928	jglqyi.exe
6892	oxucfx.exe
7664	oxevqu.exe
8100	wnldnl.exe
6404	bsrcjp.exe
7508	wsjarv.exe
548	bjamqd.exe
8200	gzrpxl.exe
8416	lnxotw.exe
8660	qhredi.exe
8828	lvgpak.exe

Loads dropped DLL 64 IoCs

pid	Process
4504	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
3564	DiskMan32.exe
2412	nrkujq.exe
4120	qrlasx.exe
4996	qvhwmk.exe
2548	vmqhtr.exe
5228	duyqqi.exe
952	drweyb.exe
3528	ixbzcz.exe
1532	fnsljh.exe
3176	keboip.exe
4656	prhnma.exe
2032	sjhlnz.exe
5812	xayoto.exe
6124	uqhasw.exe
1096	zhydze.exe
2488	frspsl.exe
1580	klvfcx.exe
5856	pzawyb.exe
1912	mtumiv.exe
2704	rgaley.exe
1228	rgklov.exe
2816	brlema.exe
1568	brvfxx.exe
1168	bhuouo.exe
4772	gnanqr.exe
6252	jplybc.exe
6416	ruiuvp.exe
6572	ttaaen.exe
6732	lqgomg.exe
6900	oikupe.exe
7064	ylmnnj.exe
6328	ecdymq.exe
6684	jtlcky.exe
4804	gkcfro.exe
3836	ingzdq.exe
700	nampzc.exe
4732	suogao.exe
2904	yhteer.exe
4176	vychdh.exe
2436	asfynt.exe
6824	courlv.exe
2732	fcjkqp.exe
5392	nwtyql.exe
4668	kbzxuw.exe
400	kjjxft.exe
7316	rvtlfp.exe
7500	rzszmh.exe
7636	ukefhx.exe
7868	xvfgfc.exe
8020	zyjsrn.exe
8180	eozdyu.exe
7408	kquhrt.exe
7620	mqunza.exe
7928	jglqyi.exe
6892	oxucfx.exe
7664	oxevqu.exe
8100	wnldnl.exe
6404	bsrcjp.exe
7508	wsjarv.exe
548	bjamqd.exe
8200	gzrpxl.exe
8416	lnxotw.exe
8660	qhredi.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\thmmfu.exe"	nugvjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\drweyb.exe"	duyqqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\rgaley.exe"	mtumiv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\fcjkqp.exe"	courlv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\rzszmh.exe"	rvtlfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\qvhwmk.exe"	qrlasx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\fnsljh.exe"	ixbzcz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\xayoto.exe"	sjhlnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\uqhasw.exe"	xayoto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\vychdh.exe"	yhteer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\rvtlfp.exe"	kjjxft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\kquhrt.exe"	eozdyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\lnxotw.exe"	gzrpxl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\frspsl.exe"	zhydze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\nampzc.exe"	ingzdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\jglqyi.exe"	mqunza.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\cdyapc.exe"	adxuhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\bhuouo.exe"	brvfxx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ingzdq.exe"	gkcfro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\suogao.exe"	nampzc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\nwtyql.exe"	fcjkqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\bsrcjp.exe"	wnldnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\sutjub.exe"	ygeqwz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\xpijjb.exe"	azpnwo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\nugvjj.exe"	lvgpak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\keboip.exe"	fnsljh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ruiuvp.exe"	jplybc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\kjjxft.exe"	kbzxuw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\mqunza.exe"	kquhrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\sjhlnz.exe"	prhnma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ttaaen.exe"	ruiuvp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\zyjsrn.exe"	xvfgfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\wnldnl.exe"	oxevqu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\gzrpxl.exe"	bjamqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\azpnwo.exe"	sutjub.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\DiskMan32.exe"	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\prhnma.exe"	keboip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\klvfcx.exe"	frspsl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\mtumiv.exe"	pzawyb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ecdymq.exe"	ylmnnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\qhredi.exe"	lnxotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\zthewr.exe"	cdyapc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\nrkujq.exe"	DiskMan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\duyqqi.exe"	vmqhtr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ixbzcz.exe"	drweyb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\brlema.exe"	rgklov.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\bjamqd.exe"	wsjarv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\adxuhd.exe"	xpijjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\lqgomg.exe"	ttaaen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\yhteer.exe"	suogao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\vmqhtr.exe"	qvhwmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\asfynt.exe"	vychdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\eozdyu.exe"	zyjsrn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\lvgpak.exe"	qhredi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\rgklov.exe"	rgaley.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\brvfxx.exe"	brlema.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\gnanqr.exe"	bhuouo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ukefhx.exe"	rzszmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\oxevqu.exe"	oxucfx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\qrlasx.exe"	nrkujq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\jplybc.exe"	gnanqr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\oikupe.exe"	lqgomg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\ylmnnj.exe"	oikupe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiskMan32 = "C:\\Windows\\courlv.exe"	asfynt.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DiskMan32.dll	vmqhtr.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	fnsljh.exe
File created	C:\Windows\SysWOW64\bhuouo.dll	brvfxx.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	gnanqr.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	jtlcky.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	eozdyu.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	lvgpak.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	cdyapc.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	pzawyb.exe
File created	C:\Windows\SysWOW64\azpnwo.dll	sutjub.exe
File created	C:\Windows\SysWOW64\duyqqi.dll	vmqhtr.exe
File created	C:\Windows\SysWOW64\drweyb.dll	duyqqi.exe
File created	C:\Windows\SysWOW64\uqhasw.dll	xayoto.exe
File created	C:\Windows\SysWOW64\frspsl.dll	zhydze.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	fcjkqp.exe
File created	C:\Windows\SysWOW64\jglqyi.dll	mqunza.exe
File created	C:\Windows\SysWOW64\lrvkyg.dll	qhredi.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	duyqqi.exe
File created	C:\Windows\SysWOW64\rgaley.dll	mtumiv.exe
File created	C:\Windows\SysWOW64\wsjarv.dll	bsrcjp.exe
File created	C:\Windows\SysWOW64\bfpznz.dll	wsjarv.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	lnxotw.exe
File created	C:\Windows\SysWOW64\ygeqwz.dll	vhesos.exe
File created	C:\Windows\SysWOW64\keboip.dll	fnsljh.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	ylmnnj.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	vychdh.exe
File created	C:\Windows\SysWOW64\adxuhd.dll	xpijjb.exe
File created	C:\Windows\SysWOW64\niudze.dll	qrlasx.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	nugvjj.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	vhesos.exe
File created	C:\Windows\SysWOW64\rgklov.dll	rgaley.exe
File created	C:\Windows\SysWOW64\oikupe.dll	lqgomg.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	nampzc.exe
File created	C:\Windows\SysWOW64\fcjkqp.dll	courlv.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	zyjsrn.exe
File created	C:\Windows\SysWOW64\thmmfu.dll	nugvjj.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	azpnwo.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	brvfxx.exe
File created	C:\Windows\SysWOW64\skxpqc.dll	yhteer.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	thmmfu.exe
File created	C:\Windows\SysWOW64\xpijjb.dll	azpnwo.exe
File created	C:\Windows\SysWOW64\vtomju.dll	suogao.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	gzrpxl.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	xpijjb.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	rgaley.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	kbzxuw.exe
File created	C:\Windows\SysWOW64\xvfgfc.dll	ukefhx.exe
File created	C:\Windows\SysWOW64\eozdyu.dll	zyjsrn.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	adxuhd.exe
File created	C:\Windows\SysWOW64\mpjhxq.dll	pzawyb.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	rgklov.exe
File created	C:\Windows\SysWOW64\ecdymq.dll	ylmnnj.exe
File created	C:\Windows\SysWOW64\aptlkp.dll	vychdh.exe
File created	C:\Windows\SysWOW64\rvtlfp.dll	kjjxft.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	mqunza.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	bjamqd.exe
File created	C:\Windows\SysWOW64\zthewr.dll	cdyapc.exe
File created	C:\Windows\SysWOW64\nrkujq.dll	DiskMan32.exe
File created	C:\Windows\SysWOW64\nugvjj.dll	lvgpak.exe
File created	C:\Windows\SysWOW64\sutjub.dll	ygeqwz.exe
File created	C:\Windows\SysWOW64\sfwyku.dll	prhnma.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	bsrcjp.exe
File created	C:\Windows\SysWOW64\qhredi.dll	lnxotw.exe
File created	C:\Windows\SysWOW64\DiskMan32.dll	ygeqwz.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\kjjxft.exe	kbzxuw.exe
File created	C:\Windows\DiskMan32.exe	jglqyi.exe
File created	C:\Windows\DiskMan32.exe	ygeqwz.exe
File created	C:\Windows\DiskMan32.exe	DiskMan32.exe
File created	C:\Windows\lqgomg.exe	ttaaen.exe
File created	C:\Windows\courlv.exe	asfynt.exe
File created	C:\Windows\DiskMan32.exe	rvtlfp.exe
File created	C:\Windows\kquhrt.exe	eozdyu.exe
File created	C:\Windows\DiskMan32.exe	vhesos.exe
File created	C:\Windows\nrkujq.exe	DiskMan32.exe
File created	C:\Windows\DiskMan32.exe	adxuhd.exe
File created	C:\Windows\DiskMan32.exe	keboip.exe
File created	C:\Windows\sjhlnz.exe	prhnma.exe
File created	C:\Windows\DiskMan32.exe	asfynt.exe
File created	C:\Windows\DiskMan32.exe	wsjarv.exe
File created	C:\Windows\lvgpak.exe	qhredi.exe
File created	C:\Windows\DiskMan32.exe	drweyb.exe
File created	C:\Windows\DiskMan32.exe	xayoto.exe
File created	C:\Windows\DiskMan32.exe	zhydze.exe
File created	C:\Windows\DiskMan32.exe	bsrcjp.exe
File created	C:\Windows\DiskMan32.exe	nrkujq.exe
File created	C:\Windows\DiskMan32.exe	uqhasw.exe
File created	C:\Windows\DiskMan32.exe	jtlcky.exe
File created	C:\Windows\DiskMan32.exe	rzszmh.exe
File created	C:\Windows\vhesos.exe	thmmfu.exe
File created	C:\Windows\azpnwo.exe	sutjub.exe
File created	C:\Windows\duyqqi.exe	vmqhtr.exe
File created	C:\Windows\drweyb.exe	duyqqi.exe
File created	C:\Windows\bhuouo.exe	brvfxx.exe
File created	C:\Windows\ylmnnj.exe	oikupe.exe
File created	C:\Windows\DiskMan32.exe	courlv.exe
File created	C:\Windows\ttaaen.exe	ruiuvp.exe
File created	C:\Windows\DiskMan32.exe	sjhlnz.exe
File created	C:\Windows\zyjsrn.exe	xvfgfc.exe
File created	C:\Windows\wnldnl.exe	oxevqu.exe
File created	C:\Windows\qhredi.exe	lnxotw.exe
File created	C:\Windows\DiskMan32.exe	klvfcx.exe
File created	C:\Windows\DiskMan32.exe	ingzdq.exe
File created	C:\Windows\suogao.exe	nampzc.exe
File created	C:\Windows\jglqyi.exe	mqunza.exe
File created	C:\Windows\vmqhtr.exe	qvhwmk.exe
File created	C:\Windows\frspsl.exe	zhydze.exe
File created	C:\Windows\wsjarv.exe	bsrcjp.exe
File created	C:\Windows\lnxotw.exe	gzrpxl.exe
File created	C:\Windows\DiskMan32.exe	sutjub.exe
File created	C:\Windows\jplybc.exe	gnanqr.exe
File created	C:\Windows\vychdh.exe	yhteer.exe
File created	C:\Windows\mqunza.exe	kquhrt.exe
File created	C:\Windows\xpijjb.exe	azpnwo.exe
File created	C:\Windows\qvhwmk.exe	qrlasx.exe
File created	C:\Windows\DiskMan32.exe	brlema.exe
File created	C:\Windows\brvfxx.exe	brlema.exe
File created	C:\Windows\DiskMan32.exe	ylmnnj.exe
File created	C:\Windows\DiskMan32.exe	vychdh.exe
File created	C:\Windows\bjamqd.exe	wsjarv.exe
File created	C:\Windows\DiskMan32.exe	cdyapc.exe
File created	C:\Windows\DiskMan32.exe	lqgomg.exe
File created	C:\Windows\DiskMan32.exe	oikupe.exe
File created	C:\Windows\DiskMan32.exe	ecdymq.exe
File created	C:\Windows\DiskMan32.exe	nwtyql.exe
File created	C:\Windows\DiskMan32.exe	xpijjb.exe
File created	C:\Windows\pzawyb.exe	klvfcx.exe
File created	C:\Windows\DiskMan32.exe	rgaley.exe
File created	C:\Windows\DiskMan32.exe	ttaaen.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nrkujq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	duyqqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prhnma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frspsl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecdymq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wsjarv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adxuhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qrlasx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pzawyb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ruiuvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rvtlfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ixbzcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uqhasw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oikupe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ingzdq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xpijjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keboip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	brvfxx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ttaaen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vychdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lnxotw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vhesos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiskMan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jplybc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nwtyql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kjjxft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ukefhx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bsrcjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qhredi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ygeqwz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qvhwmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mtumiv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcjkqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thmmfu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	azpnwo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdyapc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gkcfro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eozdyu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jglqyi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wnldnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nugvjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	klvfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nampzc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yhteer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rgaley.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sutjub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvfgfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kquhrt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gnanqr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vmqhtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fnsljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xayoto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zthewr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sjhlnz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bhuouo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lqgomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jtlcky.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kbzxuw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rzszmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gzrpxl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	suogao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asfynt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zyjsrn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4504	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
4504	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
4504	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
4504	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
3564	DiskMan32.exe
3564	DiskMan32.exe
3564	DiskMan32.exe
3564	DiskMan32.exe
2412	nrkujq.exe
2412	nrkujq.exe
2412	nrkujq.exe
2412	nrkujq.exe
4120	qrlasx.exe
4120	qrlasx.exe
4120	qrlasx.exe
4120	qrlasx.exe
4996	qvhwmk.exe
4996	qvhwmk.exe
4996	qvhwmk.exe
4996	qvhwmk.exe
2548	vmqhtr.exe
2548	vmqhtr.exe
2548	vmqhtr.exe
2548	vmqhtr.exe
5228	duyqqi.exe
5228	duyqqi.exe
5228	duyqqi.exe
5228	duyqqi.exe
952	drweyb.exe
952	drweyb.exe
952	drweyb.exe
952	drweyb.exe
3528	ixbzcz.exe
3528	ixbzcz.exe
3528	ixbzcz.exe
3528	ixbzcz.exe
1532	fnsljh.exe
1532	fnsljh.exe
1532	fnsljh.exe
1532	fnsljh.exe
3176	keboip.exe
3176	keboip.exe
3176	keboip.exe
3176	keboip.exe
4656	prhnma.exe
4656	prhnma.exe
4656	prhnma.exe
4656	prhnma.exe
2032	sjhlnz.exe
2032	sjhlnz.exe
2032	sjhlnz.exe
2032	sjhlnz.exe
5812	xayoto.exe
5812	xayoto.exe
5812	xayoto.exe
5812	xayoto.exe
6124	uqhasw.exe
6124	uqhasw.exe
6124	uqhasw.exe
6124	uqhasw.exe
1096	zhydze.exe
1096	zhydze.exe
1096	zhydze.exe
1096	zhydze.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
4504	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
3564	DiskMan32.exe
2412	nrkujq.exe
4120	qrlasx.exe
4996	qvhwmk.exe
2548	vmqhtr.exe
5228	duyqqi.exe
952	drweyb.exe
3528	ixbzcz.exe
1532	fnsljh.exe
3176	keboip.exe
4656	prhnma.exe
2032	sjhlnz.exe
5812	xayoto.exe
6124	uqhasw.exe
1096	zhydze.exe
2488	frspsl.exe
1580	klvfcx.exe
5856	pzawyb.exe
1912	mtumiv.exe
2704	rgaley.exe
1228	rgklov.exe
2816	brlema.exe
1568	brvfxx.exe
1168	bhuouo.exe
4772	gnanqr.exe
6252	jplybc.exe
6416	ruiuvp.exe
8940	azpnwo.exe
6548	xpijjb.exe
4636	adxuhd.exe
8776	cdyapc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4408	4504	jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe	81
PID 3564 wrote to memory of 4408	3564	DiskMan32.exe	81
PID 2412 wrote to memory of 4408	2412	nrkujq.exe	81
PID 4120 wrote to memory of 4408	4120	qrlasx.exe	81
PID 4996 wrote to memory of 4408	4996	qvhwmk.exe	81
PID 2548 wrote to memory of 4408	2548	vmqhtr.exe	81
PID 5228 wrote to memory of 4408	5228	duyqqi.exe	81
PID 952 wrote to memory of 4408	952	drweyb.exe	81
PID 3528 wrote to memory of 4408	3528	ixbzcz.exe	81
PID 1532 wrote to memory of 4408	1532	fnsljh.exe	81
PID 3176 wrote to memory of 4408	3176	keboip.exe	81
PID 4656 wrote to memory of 4408	4656	prhnma.exe	81
PID 2032 wrote to memory of 4408	2032	sjhlnz.exe	81
PID 5812 wrote to memory of 4408	5812	xayoto.exe	81
PID 6124 wrote to memory of 4408	6124	uqhasw.exe	81
PID 1096 wrote to memory of 4408	1096	zhydze.exe	81
PID 2488 wrote to memory of 4408	2488	frspsl.exe	81
PID 1580 wrote to memory of 4408	1580	klvfcx.exe	81
PID 5856 wrote to memory of 4408	5856	pzawyb.exe	81
PID 1912 wrote to memory of 4408	1912	mtumiv.exe	81
PID 2704 wrote to memory of 4408	2704	rgaley.exe	81
PID 1228 wrote to memory of 4408	1228	rgklov.exe	81
PID 2816 wrote to memory of 4408	2816	brlema.exe	81
PID 1568 wrote to memory of 4408	1568	brvfxx.exe	81
PID 1168 wrote to memory of 4408	1168	bhuouo.exe	81
PID 4772 wrote to memory of 4408	4772	gnanqr.exe	81
PID 6252 wrote to memory of 4408	6252	jplybc.exe	81
PID 6416 wrote to memory of 4408	6416	ruiuvp.exe	81
PID 6572 wrote to memory of 4408	6572	ttaaen.exe	81
PID 6732 wrote to memory of 4408	6732	lqgomg.exe	81
PID 6900 wrote to memory of 4408	6900	oikupe.exe	81
PID 7064 wrote to memory of 4408	7064	ylmnnj.exe	81
PID 6328 wrote to memory of 4408	6328	ecdymq.exe	81
PID 6684 wrote to memory of 4408	6684	jtlcky.exe	81
PID 4804 wrote to memory of 4408	4804	gkcfro.exe	81
PID 3836 wrote to memory of 4408	3836	ingzdq.exe	81
PID 700 wrote to memory of 4408	700	nampzc.exe	81
PID 4732 wrote to memory of 4408	4732	suogao.exe	81
PID 2904 wrote to memory of 4408	2904	yhteer.exe	81
PID 4176 wrote to memory of 4408	4176	vychdh.exe	81
PID 2436 wrote to memory of 4408	2436	asfynt.exe	81
PID 6824 wrote to memory of 4408	6824	courlv.exe	81
PID 2732 wrote to memory of 4408	2732	fcjkqp.exe	81
PID 5392 wrote to memory of 4408	5392	nwtyql.exe	81
PID 4668 wrote to memory of 4408	4668	kbzxuw.exe	81
PID 400 wrote to memory of 4408	400	kjjxft.exe	81
PID 7316 wrote to memory of 4408	7316	rvtlfp.exe	81
PID 7500 wrote to memory of 4408	7500	rzszmh.exe	81
PID 7636 wrote to memory of 4408	7636	ukefhx.exe	81
PID 7868 wrote to memory of 4408	7868	xvfgfc.exe	81
PID 8020 wrote to memory of 4408	8020	zyjsrn.exe	81
PID 8180 wrote to memory of 4408	8180	eozdyu.exe	81
PID 7408 wrote to memory of 4408	7408	kquhrt.exe	81
PID 7620 wrote to memory of 4408	7620	mqunza.exe	81
PID 7928 wrote to memory of 4408	7928	jglqyi.exe	81
PID 6892 wrote to memory of 4408	6892	oxucfx.exe	81
PID 7664 wrote to memory of 4408	7664	oxevqu.exe	81
PID 8100 wrote to memory of 4408	8100	wnldnl.exe	81
PID 6404 wrote to memory of 4408	6404	bsrcjp.exe	81
PID 7508 wrote to memory of 4408	7508	wsjarv.exe	81
PID 548 wrote to memory of 4408	548	bjamqd.exe	81
PID 8200 wrote to memory of 4408	8200	gzrpxl.exe	81
PID 8416 wrote to memory of 4408	8416	lnxotw.exe	81
PID 8660 wrote to memory of 4408	8660	qhredi.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4408
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4504

C:\Windows\DiskMan32.exe
C:\Windows\DiskMan32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564

C:\Windows\nrkujq.exe
C:\Windows\nrkujq.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\qrlasx.exe
C:\Windows\qrlasx.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120

C:\Windows\qvhwmk.exe
C:\Windows\qvhwmk.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996

C:\Windows\vmqhtr.exe
C:\Windows\vmqhtr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\duyqqi.exe
C:\Windows\duyqqi.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5228

C:\Windows\drweyb.exe
C:\Windows\drweyb.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\ixbzcz.exe
C:\Windows\ixbzcz.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3528

C:\Windows\fnsljh.exe
C:\Windows\fnsljh.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\keboip.exe
C:\Windows\keboip.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176

C:\Windows\prhnma.exe
C:\Windows\prhnma.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\sjhlnz.exe
C:\Windows\sjhlnz.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\xayoto.exe
C:\Windows\xayoto.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5812

C:\Windows\uqhasw.exe
C:\Windows\uqhasw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124

C:\Windows\zhydze.exe
C:\Windows\zhydze.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\frspsl.exe
C:\Windows\frspsl.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\klvfcx.exe
C:\Windows\klvfcx.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\pzawyb.exe
C:\Windows\pzawyb.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856

C:\Windows\mtumiv.exe
C:\Windows\mtumiv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\rgaley.exe
C:\Windows\rgaley.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704

C:\Windows\rgklov.exe
C:\Windows\rgklov.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\brlema.exe
C:\Windows\brlema.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816

C:\Windows\brvfxx.exe
C:\Windows\brvfxx.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\bhuouo.exe
C:\Windows\bhuouo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\gnanqr.exe
C:\Windows\gnanqr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772

C:\Windows\jplybc.exe
C:\Windows\jplybc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6252

C:\Windows\ruiuvp.exe
C:\Windows\ruiuvp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6416

C:\Windows\ttaaen.exe
C:\Windows\ttaaen.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6572

C:\Windows\lqgomg.exe
C:\Windows\lqgomg.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6732

C:\Windows\oikupe.exe
C:\Windows\oikupe.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6900

C:\Windows\ylmnnj.exe
C:\Windows\ylmnnj.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:7064

C:\Windows\ecdymq.exe
C:\Windows\ecdymq.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6328

C:\Windows\jtlcky.exe
C:\Windows\jtlcky.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6684

C:\Windows\gkcfro.exe
C:\Windows\gkcfro.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\ingzdq.exe
C:\Windows\ingzdq.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3836

C:\Windows\nampzc.exe
C:\Windows\nampzc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\suogao.exe
C:\Windows\suogao.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732

C:\Windows\yhteer.exe
C:\Windows\yhteer.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\vychdh.exe
C:\Windows\vychdh.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4176

C:\Windows\asfynt.exe
C:\Windows\asfynt.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\courlv.exe
C:\Windows\courlv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:6824

C:\Windows\fcjkqp.exe
C:\Windows\fcjkqp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732

C:\Windows\nwtyql.exe
C:\Windows\nwtyql.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5392

C:\Windows\kbzxuw.exe
C:\Windows\kbzxuw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668

C:\Windows\kjjxft.exe
C:\Windows\kjjxft.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:400

C:\Windows\rvtlfp.exe
C:\Windows\rvtlfp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7316

C:\Windows\rzszmh.exe
C:\Windows\rzszmh.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7500

C:\Windows\ukefhx.exe
C:\Windows\ukefhx.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7636

C:\Windows\xvfgfc.exe
C:\Windows\xvfgfc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7868

C:\Windows\zyjsrn.exe
C:\Windows\zyjsrn.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8020

C:\Windows\eozdyu.exe
C:\Windows\eozdyu.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8180

C:\Windows\kquhrt.exe
C:\Windows\kquhrt.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7408

C:\Windows\mqunza.exe
C:\Windows\mqunza.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:7620

C:\Windows\jglqyi.exe
C:\Windows\jglqyi.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7928

C:\Windows\oxucfx.exe
C:\Windows\oxucfx.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6892

C:\Windows\oxevqu.exe
C:\Windows\oxevqu.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:7664

C:\Windows\wnldnl.exe
C:\Windows\wnldnl.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8100

C:\Windows\bsrcjp.exe
C:\Windows\bsrcjp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6404

C:\Windows\wsjarv.exe
C:\Windows\wsjarv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7508

C:\Windows\bjamqd.exe
C:\Windows\bjamqd.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\gzrpxl.exe
C:\Windows\gzrpxl.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8200

C:\Windows\lnxotw.exe
C:\Windows\lnxotw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8416

C:\Windows\qhredi.exe
C:\Windows\qhredi.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8660

C:\Windows\lvgpak.exe
C:\Windows\lvgpak.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:8828

C:\Windows\nugvjj.exe
C:\Windows\nugvjj.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:8992

C:\Windows\thmmfu.exe
C:\Windows\thmmfu.exe
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9156

C:\Windows\vhesos.exe
C:\Windows\vhesos.exe
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6332

C:\Windows\ygeqwz.exe
C:\Windows\ygeqwz.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1504

C:\Windows\sutjub.exe
C:\Windows\sutjub.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6968

C:\Windows\azpnwo.exe
C:\Windows\azpnwo.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:8940

C:\Windows\xpijjb.exe
C:\Windows\xpijjb.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6548

C:\Windows\adxuhd.exe
C:\Windows\adxuhd.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4636

C:\Windows\cdyapc.exe
C:\Windows\cdyapc.exe
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:8776

C:\Windows\zthewr.exe
C:\Windows\zthewr.exe
1⤵
- System Location Discovery: System Language Discovery
PID:9084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DiskMan32.exe

Path C:\Windows\DiskMan32.exe
Size 29KB
SHA256 cf7c19171bcb403ea3f4e880ee7562dde37f08adc6431f8c9d8480116e48dd04
MD5 9ec06c20cc9c39ef5e04011da0622e6b
SHA1 a375405845e66292eb511eee3e29beb8ace56450
SHA512 2f7bd960bf7d79c8feef3f111ec47417d1e6c83ec215718db9dde4aaff39cffd7c54d5c8cc63e903737c7fbaffb3cd6a20f35c2fe98c764948d0a1e6e3eb532f
SSDEEP 768:b0NbTbHCVklgq4UtHKBqOEdkL2FikxbJe+QP:bsz+klz4ksXP
TLSH
T192D22B47675444F2D2EB4674B6520F3B9FBE88743B91E4A7C7335BC29CA42D2A534207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiskMan32.dll

Path C:\Windows\SysWOW64\DiskMan32.dll
Size 21KB
SHA256 aee70082c8fed657361bf3f17de077efd5e5025fd2cc2694606427d436219ee0
MD5 4aae4c7a5900bf12610006e7ea9497e3
SHA1 b26be68407755d4b252df62f8242756f5d94a0f2
SHA512 90aa1c139174b3a033ff36fd7f31bb2b7cbaf5590a69695b342a0b958180637964fccaa385a5a60496b97834aff251fa6ac991de72b15f610c9b59125137d654
SSDEEP 384:Dx6CV1zKlgqvs9Ut5AfwKBqOEJ4fokLlfMjKt2FikaybJqf+xSP:YCVklgq4UtHKBqOEdkL2FikxbJe+QP
TLSH
T13EA22A46975888F2E3FB4234B2920F375A7E887439D1B557CB334BD19DA41D6EA3420B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-107-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/1096-202-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/1168-324-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/1228-282-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/1532-129-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/1568-310-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/1580-228-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/1912-254-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/2032-165-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/2412-54-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/2488-215-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/2548-85-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/2704-268-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/2816-296-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/3176-141-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/3528-118-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/3564-44-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/4120-64-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/4408-99-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Download

memory/4408-67-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Download

memory/4408-132-0x0000000004E80000-0x0000000004E81000-memory.dmp

Download

memory/4408-110-0x0000000004D20000-0x0000000004D21000-memory.dmp

Download

memory/4408-144-0x0000000002C90000-0x0000000002C91000-memory.dmp

Download

memory/4408-411-0x0000000009390000-0x0000000009391000-memory.dmp

Download

memory/4408-156-0x0000000004760000-0x0000000004761000-memory.dmp

Download

memory/4408-1-0x0000000002D80000-0x0000000002D81000-memory.dmp

Download

memory/4408-168-0x0000000006490000-0x0000000006491000-memory.dmp

Download

memory/4408-397-0x0000000009150000-0x0000000009151000-memory.dmp

Download

memory/4408-180-0x00000000064C0000-0x00000000064C1000-memory.dmp

Download

memory/4408-384-0x0000000009120000-0x0000000009121000-memory.dmp

Download

memory/4408-192-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

Download

memory/4408-371-0x0000000009060000-0x0000000009061000-memory.dmp

Download

memory/4408-205-0x0000000006EF0000-0x0000000006EF1000-memory.dmp

Download

memory/4408-88-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Download

memory/4408-218-0x00000000076C0000-0x00000000076C1000-memory.dmp

Download

memory/4408-77-0x0000000002C60000-0x0000000002C61000-memory.dmp

Download

memory/4408-231-0x0000000007720000-0x0000000007721000-memory.dmp

Download

memory/4408-357-0x0000000009030000-0x0000000009031000-memory.dmp

Download

memory/4408-244-0x0000000007DD0000-0x0000000007DD1000-memory.dmp

Download

memory/4408-342-0x0000000008F80000-0x0000000008F81000-memory.dmp

Download

memory/4408-257-0x0000000008970000-0x0000000008971000-memory.dmp

Download

memory/4408-121-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Download

memory/4408-271-0x0000000008A70000-0x0000000008A71000-memory.dmp

Download

memory/4408-57-0x0000000004B20000-0x0000000004B21000-memory.dmp

Download

memory/4408-285-0x0000000008CA0000-0x0000000008CA1000-memory.dmp

Download

memory/4408-47-0x0000000004920000-0x0000000004921000-memory.dmp

Download

memory/4408-299-0x0000000007710000-0x0000000007711000-memory.dmp

Download

memory/4408-49-0x0000000004930000-0x0000000004931000-memory.dmp

Download

memory/4408-313-0x0000000006470000-0x0000000006471000-memory.dmp

Download

memory/4408-327-0x0000000008F40000-0x0000000008F41000-memory.dmp

Download

memory/4504-36-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/4656-152-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/4772-339-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/4996-74-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/5228-96-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/5812-177-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/5856-241-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/6124-189-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/6252-354-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/6416-368-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/6572-381-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/6732-394-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/6900-408-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/7064-422-0x0000000010000000-0x0000000010009000-memory.dmp

Download